This vulnerability (CVE-2026-0390) affects Windows 10 Version 1607 (build 10.0.14393.0) and is categorized under CWE-807, which involves reliance on untrusted inputs in a security decision. Specifically, the Windows Boot Loader improperly trusts input data, enabling an authorized local attacker with high privileges to bypass security controls. The vulnerability has a CVSS v3.1 base score of 6.7 with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.

An authorized local attacker with high privileges can exploit this vulnerability to bypass a security feature in the Windows Boot Loader, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-0390. Applying this patch will remediate the vulnerability.